CVE-2025-71430: Frappe before 15.91.1 Stored XSS via Leaderboard User Names

Q: Which deployments are affected?

Frappe versions before 14.99.10 are affected, as are 15.x versions before 15.91.1. The vulnerable rendering occurs on the leaderboard page.

Q: What access does an attacker need?

An attacker needs an authenticated account and the ability to set a crafted user name. Exploitation also requires another user to view the leaderboard containing that name.

Q: What is the practical impact if exploitation succeeds?

The crafted user name can execute arbitrary JavaScript in the browser of a user viewing the leaderboard. The stated impact includes potential loss of confidentiality and integrity in the affected user's browser context.

Q: How can I determine whether exploitation may have occurred?

Review user names for suspicious markup or script-like content, particularly for accounts that may appear on the leaderboard. Also review access or application logs for leaderboard views by users after such names were set, if those records are available.

Published Oct 12, 2026

Updated

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.

Affected Software

1 affected component

Frappe frappe<14.99.10, <15.91.1

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe versions before 14.99.10 are affected, as are 15.x versions before 15.91.1. The vulnerable rendering occurs on the leaderboard page.

What access does an attacker need?

An attacker needs an authenticated account and the ability to set a crafted user name. Exploitation also requires another user to view the leaderboard containing that name.

What is the practical impact if exploitation succeeds?

The crafted user name can execute arbitrary JavaScript in the browser of a user viewing the leaderboard. The stated impact includes potential loss of confidentiality and integrity in the affected user's browser context.

How can I determine whether exploitation may have occurred?

Review user names for suspicious markup or script-like content, particularly for accounts that may appear on the leaderboard. Also review access or application logs for leaderboard views by users after such names were set, if those records are available.

CVE-2025-71430: Frappe before 15.91.1 Stored XSS via Leaderboard User Names

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the practical impact if exploitation succeeds?

How can I determine whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the practical impact if exploitation succeeds?

How can I determine whether exploitation may have occurred?